---
id: CVE-2026-107100
title: >-
  Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post
  Content Disclosure via wpr_get_page_content
summary: >-
  The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not
  verify that a requested post is publicly viewable before returning its content
  via an unauthenticated AJAX action, relying only on the published status and
  not on …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-200
product: Royal Addons for Elementor
affected:
  - royal_addons_for_elementor >= 1.3.81 < 1.7.1070
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-28T17:47:34.363779Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:58:07.790Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107100'
references:
  - url: 'https://wpscan.com/vulnerability/12d7734c-ef28-445b-9625-5ba0271e9fa7/'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05547
ingestedAt: '2026-10-28T07:06:27.148Z'
---

## Overview

The Royal Addons for Elementor  WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.

## Affected

- `royal_addons_for_elementor >= 1.3.81 < 1.7.1070`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.